feat: Setup default permissions for package versions

casual-simulation · Nov 18, 2024 · 6e97443 · 6e97443
1 parent 66716b1
commit 6e97443
Show file tree

Hide file tree

Showing 3 changed files with 63 additions and 1 deletion.
diff --git a/src/aux-records/PolicyController.spec.ts b/src/aux-records/PolicyController.spec.ts
@@ -2561,6 +2561,7 @@ describe('PolicyController', () => {
             ['webhook'],
             ['notification'],
             ['package'],
+            ['package.version'],
         ];
 
         // Admins can perform all actions on all resources
@@ -3653,6 +3654,28 @@ describe('PolicyController', () => {
                     ['listSubscriptions', 'resourceId'],
                 ],
             ],
+            [
+                'package.version',
+                [
+                    ['create', 'resourceId'],
+                    ['delete', 'resourceId'],
+                    ['update', 'resourceId'],
+                    ['read', 'resourceId'],
+                    ['list', null],
+                    ['assign', 'resourceId'],
+                    ['unassign', 'resourceId'],
+                    ['grant', 'resourceId'],
+                    ['revoke', 'resourceId'],
+                    ['grantPermission', 'resourceId'],
+                    ['revokePermission', 'resourceId'],
+                    ['count', 'resourceId'],
+                    ['increment', 'resourceId'],
+                    ['run', 'resourceId'],
+                    ['send', 'resourceId'],
+                    ['subscribe', 'resourceId'],
+                    ['listSubscriptions', 'resourceId'],
+                ],
+            ],
         ];
 
         const recordKeySubjectTypeDenialCases: [SubjectType, string][] = [
@@ -3774,6 +3797,16 @@ describe('PolicyController', () => {
             ],
             [
                 'package',
+                [
+                    ['create', 'resourceId'],
+                    ['delete', 'resourceId'],
+                    ['update', 'resourceId'],
+                    ['read', 'resourceId'],
+                    ['list', null],
+                ],
+            ],
+            [
+                'package.version',
                 [
                     ['create', 'resourceId'],
                     ['delete', 'resourceId'],
@@ -4287,6 +4320,13 @@ describe('PolicyController', () => {
                     ['list', null],
                 ],
             ],
+            [
+                'package.version',
+                [
+                    ['read', 'resourceId'],
+                    ['list', null],
+                ],
+            ],
         ];
 
         const publicReadSubjectTypeCases: [
@@ -4408,6 +4448,13 @@ describe('PolicyController', () => {
             ],
             [
                 'package',
+                [
+                    ['read', 'resourceId'],
+                    ['list', null],
+                ],
+            ],
+            [
+                'package.version',
                 [
                     ['read', 'resourceId'],
                     ['run', 'resourceId'],

diff --git a/src/aux-records/PolicyController.ts b/src/aux-records/PolicyController.ts
@@ -84,7 +84,8 @@ const ALLOWED_STUDIO_MEMBER_RESOURCES: [ResourceKinds, ActionKinds[]][] = [
     ],
     ['loom', ['create']],
     ['webhook', ['read', 'create', 'delete', 'update', 'list', 'run']],
-    ['package', ['read', 'create', 'delete', 'update', 'list', 'run']],
+    ['package', ['read', 'create', 'delete', 'update', 'list']],
+    ['package.version', ['read', 'create', 'delete', 'update', 'list', 'run']],
 ];
 
 const ALLOWED_MODERATOR_ACTIONS = new Set<string>([

diff --git a/src/aux-records/PolicyStore.ts b/src/aux-records/PolicyStore.ts
@@ -795,6 +795,13 @@ export function getPublicReadPermission(
                 action,
             };
         }
+    } else if (resourceKind === 'package.version') {
+        if (action === 'read' || action === 'list') {
+            return {
+                resourceKind,
+                action,
+            };
+        }
     }
 
     // All other actions are not allowed.
@@ -869,6 +876,13 @@ export function getPublicWritePermission(
             };
         }
     } else if (resourceKind === 'package') {
+        if (action === 'read' || action === 'list') {
+            return {
+                resourceKind,
+                action,
+            };
+        }
+    } else if (resourceKind === 'package.version') {
         if (action === 'read' || action === 'list' || action === 'run') {
             return {
                 resourceKind,